Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-5154)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability found in the cri-o component which could allow an attacker to send a specially crafted URL request containing "dot dot" sequences /../ to read and write arbitrary files on the system. Vulnerability Details CVEID:...

Improper Neutralization

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Neutralization in the RewriteValve class, which handles rewrite rules. If rewrite rules are configured to enforce security constraints, those security...

Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET “Connector”. When using the Easy Logging feature on Linux and macOS, the Connector didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local...

GHSA-C82R-C9F7-F5MJ Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET “Connector”. When using the Easy Logging feature on Linux and macOS, the Connector didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local...

CVE-2025-31650

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial ...

CVE-2025-31650 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial ...

CVE-2025-4011

A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to...

CVE-2025-4011

CVE-2025-4011 affects Redmine versions 6.0.0–6.0.3, where the unknown code path in the Custom Query Handler improperly handles the argument named “Name”, enabling remote Cross‑Site Scripting (XSS) . The impact is limited to client-side execution and depends on user interaction as described by the...

CVE-2025-4011 Redmine Custom Query cross site scripting

A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to...

CVE-2025-29953

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious...

CVE-2025-26413

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the offset input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. User...

CVE-2024-56736

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

Debian dla-4139 : imagemagick - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4139 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4139-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-32965

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely t...

Incorrect Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Incorrect Authorization via the cohorts report. An attacker can access unauthorized cohort data by exploiting insufficient access control checks. Remediation Upgrade moodle/moodle to version 4.1.18,...

Cross-site Request Forgery (CSRF)

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to insufficient CSRF protection in the user tours manager. An attacker can duplicate existing tours without needing authentication by exploiting this vulnerabilit...

Information Exposure

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Information Exposure via the assignment submissions search feature. An attacker can reveal student identities by exploiting the search functionality on anonymous submissions. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the updateChannelAction function, which does not sufficiently check user permissions before executing a delete operation. Any user can delete posts containing actions posted by the Playbooks bot. Remediation...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper permission settings on a UNIX domain socket. An attacker can gain unauthorized access or perform unauthorized actions by running juju-run 'whoami' which escalates privileges to root level. Remediati...

Command Injection

Overview YoutubeDLSharp is a simple .NET wrapper library for youtube-dl and yt-dlp. Affected versions of this package are vulnerable to Command Injection due to improper sanitization of command line arguments. An attacker can execute arbitrary commands by injecting malicious input into the comman...